CVE-2025-10143: Catch Dark Mode WordPress Plugin RCE Flaw

CVE-2025-10143 Overview

CVE-2025-10143 is a Local File Inclusion (LFI) vulnerability in the Catch Dark Mode plugin for WordPress, affecting all versions up to and including 2.0. The flaw resides in the catch_dark_mode shortcode, which fails to properly validate file paths before inclusion. Authenticated attackers with Contributor-level access or above can include and execute arbitrary .php files on the server. This permits execution of any PHP code contained in those files, enabling access control bypass, sensitive data disclosure, and remote code execution where attackers can stage .php content on the host. The vulnerability is classified under [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Authenticated Contributor-level users can execute arbitrary PHP code on the server through the vulnerable shortcode, leading to full site compromise.

Affected Products

Catch Dark Mode plugin for WordPress, all versions through 2.0
WordPress sites where Contributor or higher accounts exist
Hosting environments where attackers can stage .php files via uploads or log poisoning

Discovery Timeline

2025-09-17 - CVE-2025-10143 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10143

Vulnerability Analysis

The vulnerability stems from unsafe handling of user-controlled input passed to a PHP include or require statement inside the catch_dark_mode shortcode handler. WordPress shortcodes accept attributes that authenticated authors can embed in post content. When the shortcode processes its attributes, it concatenates user-supplied values into a file path used for inclusion without sufficient validation or allow-listing.

Because the attack vector is network-based and requires only Contributor-level credentials, any user permitted to author posts becomes a potential entry point. Contributor accounts are common on multi-author WordPress sites and are often granted through self-registration or limited editorial workflows. Successful exploitation grants the attacker arbitrary PHP execution within the web server process, equivalent to full site takeover.

Root Cause

The root cause is improper neutralization of the filename argument passed to a PHP file inclusion function within the shortcode logic at plugin.php line 483. The plugin does not constrain inclusion targets to a trusted directory and does not strip path traversal sequences or enforce extension allow-lists. This pattern is the canonical [CWE-98] weakness.

Attack Vector

An authenticated attacker authors a post containing the catch_dark_mode shortcode with a crafted attribute pointing to a .php file already present on the server. Targets include uploaded media renamed with .php extensions, log files containing attacker-controlled strings, or local PHP files that expose sensitive functionality when executed out of context. When the post is rendered, the plugin includes and executes the referenced file. Real exploitation details are documented in the Wordfence Vulnerability Analysis and the WordPress Plugin Code Snapshot.

Detection Methods for CVE-2025-10143

Indicators of Compromise

Posts or revisions authored by Contributor accounts containing the catch_dark_mode shortcode with file, path, or template attributes referencing absolute paths or traversal sequences such as ../.
Web server access logs showing requests to posts that render the shortcode, followed by anomalous PHP execution traces.
Unexpected .php files in wp-content/uploads/ or other writable directories.
New administrative WordPress users, modified wp-config.php, or webshell artifacts created shortly after a Contributor logs in.

Detection Strategies

Audit all posts and post revisions for occurrences of the catch_dark_mode shortcode and inspect their attribute values.
Enable PHP open_basedir logging or use a runtime application self-protection module to alert on inclusion of files outside the WordPress install path.
Correlate Contributor login events with subsequent post creation containing shortcodes and outbound network connections from the web server.

Monitoring Recommendations

Forward WordPress audit logs, web server access logs, and PHP error logs to a centralized SIEM for correlation against Contributor account activity.
Alert on file system writes that create .php files inside upload directories or theme directories.
Monitor for newly registered users elevated from Subscriber to Contributor and review their first authored content.

How to Mitigate CVE-2025-10143

Immediate Actions Required

Update the Catch Dark Mode plugin to the patched release published in WordPress Change Set 3359058, or deactivate and remove the plugin if updates are unavailable.
Audit all Contributor, Author, and Editor accounts; disable any that are unused or suspicious.
Review recent posts and revisions for malicious shortcode usage and remove offending content.

Patch Information

The vendor addressed the Local File Inclusion in changeset 3359058 published on the WordPress.org plugin repository. Site administrators should upgrade to the latest available version of the plugin from the WordPress Catch Dark Mode Plugin page. Verify the installed version under the Plugins screen after the update completes.

Workarounds

Restrict the Contributor role from publishing or saving content containing the catch_dark_mode shortcode using a shortcode filter in a mu-plugin.
Configure PHP open_basedir to constrain file inclusion to the WordPress installation directory, preventing traversal to system paths.
Disable PHP execution in wp-content/uploads/ via web server configuration to neutralize uploaded .php payloads.

bash

# Apache: disable PHP execution in uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phar)$">
    Require all denied
</FilesMatch>

# Nginx equivalent in server block
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}